chore: dockerfile (testing)

deploy/docker/README.md

@@ -0,0 +1,71 @@
+# Container image
+
+`Dockerfile` (repo root) builds a single OCI image with the Vite frontend
+already built in, and a `.venv` with all Python deps. At runtime it uses
+`supervisord` (`deploy/docker/supervisord.conf`) to run two processes in the
+one container:
+
+- `web` - one `daphne` process serving the Django/Channels app on `:8000`
+- `worker` - two `rqworker` processes for background jobs (submission OCR,
+  AAndT sync, etc.)
+
+Postgres, Redis and S3-compatible storage are **not** bundled - the image
+expects them the same way the bare-metal deploy does (see
+`deploy/supervisor/polylan-submitter.env.dist` for the full list of env
+vars: `POSTGRES_*`, `REDIS_HOST`/`REDIS_PORT`, `AWS_*`, `DJANGO_SECRET_KEY`,
+etc.). Point those at wherever those services already live (other
+containers/LXCs, or existing infra).
+
+## Build
+
+Requires BuildKit/buildx (`RUN --mount=type=cache` in the Dockerfile is
+rejected by the legacy builder):
+
+```sh
+docker buildx build --load -t polylan-submitter .
+```
+
+## Run
+
+```sh
+docker run -d \
+  --name polylan-submitter \
+  --env-file deploy/supervisor/polylan-submitter.env \
+  -p 8000:8000 \
+  polylan-submitter
+```
+
+Migrations run automatically on container start (set `MIGRATE_ON_START=false`
+to skip). `collectstatic` does not run automatically - it pushes to the
+shared S3 bucket, so run it once per deploy instead of racing multiple
+replicas on every boot:
+
+```sh
+docker run --rm --env-file deploy/supervisor/polylan-submitter.env \
+  polylan-submitter python manage.py collectstatic --noinput
+```
+
+## Scaling
+
+There's one `daphne` process per container (unlike the bare-metal deploy's
+`NUM_WEB_WORKERS` behind HAProxy) - scale by running multiple container
+replicas behind an external reverse proxy/load balancer instead.
+
+## Deploying to Proxmox
+
+Recent Proxmox VE versions can create an LXC container directly from an OCI
+image (`pct create <vmid> <image-ref> ...` with an OCI-format image
+reference, currently a tech-preview feature - check `pct create --help` and
+the Proxmox VE docs for your installed version, since the exact flags have
+been changing across releases). Practically that means:
+
+1. Push the built image to a registry Proxmox can reach (a local registry,
+   GHCR, Docker Hub, etc.) - `docker tag`/`docker push`.
+2. Create the container on the Proxmox host from that image reference,
+   passing the same env vars as above.
+3. Map/forward port 8000 as needed, and put whatever TLS-terminating
+   reverse proxy you already run in front of it.
+
+If OCI-to-LXC isn't available on your Proxmox version, the same image runs
+fine in a plain VM (or an LXC) with any container runtime (Docker/Podman)
+installed instead.

deploy/docker/entrypoint.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Container entrypoint: runs migrations (unless disabled), then execs
+# whatever CMD supplied (supervisord by default - see the Dockerfile).
+#
+# collectstatic is intentionally NOT run here: it pushes to the shared S3
+# bucket (see STORAGES in settings.py), so running it on every container
+# start would race across replicas for no benefit - run it once per deploy
+# instead:
+#   docker run --rm --env-file <env file> polylan-submitter \
+#       python manage.py collectstatic --noinput
+
+set -euo pipefail
+
+if [ "${MIGRATE_ON_START:-true}" = "true" ]; then
+    echo "Running migrations..."
+    python manage.py migrate --noinput
+fi
+
+exec "$@"

deploy/docker/push.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env sh
+# One-off build+push to the Gitea container registry for testing.
+# Usage: deploy/docker/push.sh [tag]   (run from repo root, default tag: test)
+set -eu
+
+REGISTRY=git.legrems.mom
+OWNER=polylan
+IMAGE=polylan-submitter
+TAG="${1:-test}"
+
+cd "$(dirname "$0")/../.."
+
+REF="$REGISTRY/$OWNER/$IMAGE:$TAG"
+# buildx (BuildKit) is required: the Dockerfile uses RUN --mount=type=cache
+# for the uv dep cache, which the legacy builder rejects.
+docker buildx build --load -t "$REF" .
+docker push "$REF"
+
+echo "Pushed $REF"

deploy/docker/supervisord.conf

@@ -0,0 +1,46 @@
+; Runs inside the single app container as the non-root "app" user (see
+; Dockerfile's USER app - no [supervisord] user= needed, we never start as
+; root here). Unlike deploy/supervisor/polylan-submitter.conf (multiple
+; daphne processes behind HAProxy on one bare-metal host), this container
+; runs ONE daphne process on TCP: scale by running more container replicas
+; behind an external reverse proxy/load balancer instead of more processes
+; per container.
+;
+; Program logs go to stdout/stderr (logfile_maxbytes=0 disables supervisor's
+; own log rotation for them) so `docker logs` / Proxmox's log viewer picks
+; them up - no log files inside the container to manage.
+
+[supervisord]
+nodaemon=true
+pidfile=/tmp/supervisord.pid
+logfile=/dev/null
+logfile_maxbytes=0
+
+[program:web]
+command=/app/.venv/bin/daphne -b 0.0.0.0 -p 8000 polylan_submitter.asgi:application
+directory=/app/polylan_submitter
+autostart=true
+autorestart=true
+stopasgroup=true
+killasgroup=true
+stopsignal=TERM
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+; RQ workers - same command as deploy/supervisor/polylan-submitter.conf.
+[program:worker]
+command=/app/.venv/bin/python manage.py rqworker default --job-class django_tasks_rq.Job --with-scheduler
+directory=/app/polylan_submitter
+process_name=%(program_name)s-%(process_num)02d
+numprocs=2
+autostart=true
+autorestart=true
+stopasgroup=true
+killasgroup=true
+stopsignal=TERM
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0